directus - Browse /v12.5.0 at SourceForge.net

The interactive file manager requires Javascript. Please enable it or use sftp or scp.
You may still browse the files here.

Name	Modified	Size	InfoDownloads / Week
Parent folder
directus-12.5.0-dhi.buildtime.cdx.json	2026-10-07	8.1 MB	0
directus-12.5.0-dhi.buildtime.spdx.json	2026-10-07	13.4 MB	0
directus-12.5.0-dhi.runtime.cdx.json	2026-10-07	1.9 MB	0
directus-12.5.0-dhi.runtime.spdx.json	2026-10-07	2.8 MB	0
directus-12.5.0.buildtime.cdx.json	2026-10-07	8.1 MB	0
directus-12.5.0.runtime.cdx.json	2026-10-07	1.9 MB	0
directus-12.5.0.runtime.spdx.json	2026-10-07	2.9 MB	0
README.md	2026-10-07	16.5 kB	0
v12.5.0 source code.tar.gz	2026-10-07	7.8 MB	0
v12.5.0 source code.zip	2026-10-07	10.1 MB	2
Totals: 10 Items		56.9 MB	2

⚠️ Potential Breaking Changes

Fixed TFA enforcement to use effective permissions (#28176) Policies with an IP allow list are now accounted for when enforcing TFA within the allowed range.

Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses (#28331) The /server/license response no longer includes downgrade_reason. Read invalid_reason instead, which also reports why a license that is still in effect could not be renewed.

@directus/errors no longer exports LicenseManagedByEnvError, LicenseOfflineUnsupportedError, LicenseResolveIncompleteError or LicenseServiceUnavailableError, or their error codes. License request failures now surface as LICENSE_INVALID with a failure extension, or as the standard FORBIDDEN, INVALID_PAYLOAD, REQUESTS_EXCEEDED and SERVICE_UNAVAILABLE errors.

Removed the ip-matching dependency (#28243) Policy ip_access and IMPORT_IP_DENY_LIST values are now more strictly validated. Subnets with a malformed prefix such as 10.0.0.0/ 24 or 10.0.0.0/+24, are no longer accepted.

Existing policies that already store such a value will fail every request for users with that policy.

Fixed requests failing after a process was stopped during schema building (#28316) CACHE_SCHEMA_MAX_ITERATIONS has been removed. CACHE_SCHEMA_SYNC_TIMEOUT now also limits the schema build itself and defaults to 60000 ms.

If you have configured a lower value, make sure it is long enough for your schema to finish building.

Updated outdated type definitions for directus_notifications, directus_permissions, directus_extensions, directus_fields, directus_activity, directus_collections, and directus_revisions (#28072) Breaking changes in @directus/sdk:

DirectusNotification.id is now correctly typed as number.
DirectusField.schema is now nullable.
FieldMetaConditionOptionType has been removed; condition options is now Record<string, any>.
FieldMetaConditionType.hidden, readonly, required, and options are now optional, and rule is typed as a filter.
All ExtensionSchema properties are now optional, and DirectusExtension.schema can also be an ExtensionSchemaEntry.

Breaking changes in @directus/types:

Notification.id is now correctly typed as number.
Notification.status and timestamp are now nullable.
@directus/api
Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses (#28331 by @ComfortablyCoding)
Removed the ip-matching dependency (#28243 by @Nitwel)
Fixed requests failing after a process was stopped during schema building (#28316 by @Nitwel)
@directus/errors
Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses (#28331 by @ComfortablyCoding)
@directus/utils
Removed the ip-matching dependency (#28243 by @Nitwel)
@directus/types
Updated outdated type definitions for directus_notifications, directus_permissions, directus_extensions, directus_fields, directus_activity, directus_collections, and directus_revisions (#28072 by @kheiner)
@directus/sdk
Updated outdated type definitions for directus_notifications, directus_permissions, directus_extensions, directus_fields, directus_activity, directus_collections, and directus_revisions (#28072 by @kheiner)

✨ New Features & Improvements

@directus/app
Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
Added header bar buttons to set multiple selected Flows to active or inactive (#28321 by @robluton)
Added a confirmation dialog when saving Public policy permission changes on system collections (#28311 by @robluton)
Added a persistent warning notice when editing the Public policy (#28310 by @robluton)
Added support for linking images in the WYSIWYG editor: select an image and use the link toolbar button (or Mod+K) to wrap it in an anchor; stored <a href><img></a> markup now survives loading without triggering the normalization warning (#28289 by @alvarosabu)
@directus/api
Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
@directus/memory
Added opt-in hash option to redis memory, improving cache clear performance (#28214 by @Nitwel)
Added optional lock settings to usingLock to override the lock's duration and retry count. A signal is now passed to the callback that aborts if the lock is lost before it finishes (#28331 by @ComfortablyCoding)
@directus/system-data
Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
@directus/types
Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
@directus/sdk
Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
@directus/constants
Added a persistent warning notice when editing the Public policy (#28310 by @robluton)
@directus/env
Exported the default environment values as DEFAULTS (#28077 by @br41nslug)

🐛 Bug Fixes & Optimizations

@directus/app
Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
Update license validation to only accept Directus keys and tokens (#28331 by @ComfortablyCoding)
Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses (#28331 by @ComfortablyCoding)
Fixed tooltips not appearing on keyboard focus (#28263 by @robluton)
Fixed Norwegian time format patterns that displayed raw timestamps instead of times in datetime fields (#28332 by @u12206050)
Fixed the module navigation scrolling back to the top when navigating to another page (#28269 by @khanahmad4527)
Fixed AI translations creating duplicate target language rows when streaming multiple fields. (#28074 by @xmflsct)
Updated outdated type definitions for directus_notifications, directus_permissions, directus_extensions, directus_fields, directus_activity, directus_collections, and directus_revisions (#28072 by @kheiner)
Cleaned unsupported markup from pasted content in the WYSIWYG editor and flagged it inline, with a view of what was removed and the choice to undo the paste or redo it raw in the raw HTML editor (#28238 by @alvarosabu)
@directus/api
Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
Update license validation to only accept Directus keys and tokens (#28331 by @ComfortablyCoding)
Fixed OpenAPI spec version to only change when the generated spec does (#28109 by @kheiner)
Fixed creating a collection with neither schema nor meta returning a misleading 403 instead of a 400 validation error (#28258 by @kheiner)
Fixed filtering and GraphQL typing of geometry subtype fields (e.g. geometry.Point) (#28308 by @PINYOPATTANAWASANPORN)
Fixed license boot holding a lock for the entirety of startup (#28331 by @ComfortablyCoding)
Fixed GraphQL marking not-null fields with a default value as nullable in queries and fields with falsey default values as required in create mutations (#28280 by @Dextheking1)
Added opt-in hash option to redis memory, improving cache clear performance (#28214 by @Nitwel)
Fixed TFA enforcement to use effective permissions (#28176 by @psang39)
Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
Fixed GraphQL fragments on the union type of one M2A field returning no data when spread into another M2A field (#28305 by @Nitwel)
Unified related collection lookups to use getRelationInfo (#28246 by @Nitwel)
Fixed a GraphQL query with a __proto__ field alias being able to write a property onto Object.prototype. (#28211 by @datrixlab)
Improved validation of storage locations and paths for files (#28077 by @br41nslug)
@directus/extensions-sdk
Fixed directus-extension validate passing or crashing on missing extension paths (#28320 by @PINYOPATTANAWASANPORN)
Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
@directus/composables
Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
@directus/extensions
Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
@directus/stores
Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
@directus/themes
Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
@directus/types
Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
@directus/utils
Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
Fixed filtering and GraphQL typing of geometry subtype fields (e.g. geometry.Point) (#28308 by @PINYOPATTANAWASANPORN)
Unified related collection lookups to use getRelationInfo (#28246 by @Nitwel)
@directus/specs
Fixed creating a collection with neither schema nor meta returning a misleading 403 instead of a 400 validation error (#28258 by @kheiner)
@directus/cli
Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
@directus/storage-driver-cloudinary
Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
@directus/storage-driver-supabase
Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
@directus/update-check
Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
@directus/env
Fixed requests failing after a process was stopped during schema building (#28316 by @Nitwel)
@directus/sdk
Fixed readActivity, deletePermission, readPermission, updatePermission, readItemPermissions, readNotification, and readRevision not rejecting a null or undefined key or collection (#28072 by @kheiner)